R1's handover: the daemon exchanges the session an older desktop stored for its own credential, once

The stored session of a desktop older than R1, as the bearer; no page sign-in and no code. Any request carrying Origin is refused (403), and a device credential is not a session (401). The device must be one the person registered from a desktop older than R1 and last called from at such a version, and that never held a credential of its own: an unknown id, or one last seen at R1 or later, is 403; one that ever enrolled is 409 session-exchanged. Once per device and once per session: a second exchange is 409 session-exchanged, except the same session for the same device again (an answer that was lost), which answers 200 with a fresh credential and stops the first. A device_id registered to another person is 409 conflict and that device is left as it was; a revoked device is 403. The credential is answered once and stored as its hash. Deleted at phase 7.