Read a public URL’s password, and the cookie that opens it

For anyone with access to the computer. password is the one set with PATCH; cookie is what the password form sets in a visitor’s browser, so a client that opens the URL itself (in its own web view) can skip the form: send it as Cookie: __Host-orgo_pass=<value>. It works until the password changes. Both null for a URL anyone can open. Never cached.