Author impersonation via replayable token transfer

Authentication bypass in Etherpad before 3.1.0 allows remote attackers to impersonate an author via a leaked token-transfer URL. In src/node/hooks/express/tokenTransfer.ts, GET /tokenTransfer/{uuid} redeems stored author-token records without checking createdAt for expiry, does not remove the record after success, and sends the full tokenData object back to the caller, exposing the raw token as well as setting a fresh HttpOnly cookie. Exploitation requires disclosure of a transfer UUID from a QR code, history entry, log, screenshot, or similar channel, after which the same UUID can be replayed to read and write pads as the originating author until that token is otherwise invalidated.