web: recipes iframe loads /recipes with the token (the page document itself is token-gated)

src/web/ui.html

@@ -1703,7 +1703,7 @@ function openRecipes(g) {
   recipesWin = makeWin({
     id: "win-recipes", title: "Recipes", x: r("left", 24), y: r("top", 24),
     w: r("width", Math.min(1180, innerWidth - 48)), h: r("height", Math.min(760, innerHeight - 80)),
-    bodyHtml: `<iframe src="/recipes" title="recipes report"></iframe>`,
+    bodyHtml: `<iframe src="${auth("/recipes")}" title="recipes report"></iframe>`,
     extraCls: "recwin",
     removeOnClose: true,
     onClosed: () => { recipesWin = null; },