[Bugfix] Improve OPML route security (#535)

* WIP - moved plugs; set up a new token-protected route plug

* Added a route_token column to settings model

* Hooked up token_protected_route plug to database

* Hooked up new OPML route to UI; turned RSS and OPML feed buttons into links

* Docs, tests

* Added a note about the phoenix bug

lib/pinchflat_web/controllers/sources/source_html.ex

@@ -40,11 +40,13 @@ defmodule PinchflatWeb.Sources.SourceHTML do
   end
 
   def rss_feed_url(conn, source) do
+    # NOTE: The reason for this concatenation is to avoid what appears to be a bug in Phoenix
+    # See: https://github.com/phoenixframework/phoenix/issues/6033
     url(conn, ~p"/sources/#{source.uuid}/feed") <> ".xml"
   end
 
   def opml_feed_url(conn) do
-    url(conn, ~p"/sources/opml") <> ".xml"
+    url(conn, ~p"/sources/opml.xml?#{[route_token: Settings.get!(:route_token)]}")
   end
 
   def output_path_template_override_placeholders(media_profiles) do