[ingvarch]

What changes

Every request carries the ACL token. Over plain HTTP anyone on the network between you and the cluster can read it, and nothing said so. Now, when a token is set and the address is http:// to another machine, the status line warns once the cluster first answers, and again after each switch of cluster:

! the token goes to http://nomad.example:4646 without TLS

• nomad.Client.SendsTokenInClear decides it at New: a token is set, the scheme is http, and the host is not localhost, 127.0.0.0/8 or ::1. A unix socket and https do not warn. InRegion keeps the value.
• The warning shows once per connection. It does not replace an error, another warning or a command that is still running: it waits for a later answer. A failed first read keeps its error, and the warning comes with the first answer.
• On a switch of cluster the warning takes the place of Connected to <name>.; the header still names the cluster.
• docs/configuration.md says when the warning appears, under Token.

Checked by hand against the dev agent: NOMAD_ADDR=http://localhost.:4646 with a token shows the warning, http://127.0.0.1:4646 shows nothing.

Issues

Closes #201

Checklist

• The test for this change was written first and failed
• make check is green
• The guide in docs/ is updated if users see a difference
• The title is a conventional commit: feat(ui): ..., fix(nomad): ...