-- ws roles: communicate with the browser for getting credentials: login page, krb negotiation, client cert
+- browsers and JS only speak HTTP and WebSocket, and can't directly talk to Linux system APIs
+- so you always need a web server somewhere, cockpit-ws
+- ws purpose: communicate with the browser for getting credentials: login page, krb negotiation, client cert