Refuse OPDS logins when CWA accepts every password

A CWA with anonymous browsing can answer an OPDS request whatever the
password, so each password logged a user in to Bindery. Bindery now
tests CWA with a login that cannot exist, and refuses OPDS logins if
CWA accepts it. A login check no longer shares the session of the
account of Bindery. The CWA account stays optional for a CWA that asks
for no login, and a missing account now gets its own message.

tests/fake_cwa.py

@@ -26,6 +26,8 @@ class FakeCwa:
         self.requests: list[str] = []
         # CWA's "Show Publisher Section" setting. Without it, the publisher feed is 404.
         self.publisher_view = True
+        # CWA's anonymous browsing. With it, the fake answers every request, with or without a login.
+        self.anonymous = False
         fake = self
 
         class Handler(BaseHTTPRequestHandler):
@@ -87,7 +89,7 @@ class FakeCwa:
         self._send(h, 200, self._feed([self._book_entry(b) for b in page], next_href), "application/atom+xml")
 
     def handle(self, h) -> None:
-        if not self._authorized(h):
+        if not self.anonymous and not self._authorized(h):
             self._send(h, 401, b"Unauthorized", "text/plain")
             return
         url = urlparse(h.path)