cli: use powershell for browser opening under WSL to handle long urls

Merge upstream/master app-password auth into secure-sessions