Fix issues found in review of host pairing

- Saves of a datastore run one at a time, and changes made while saving
  are saved by the next save. Overlapping saves from approving and
  revoking hosts could write an older snapshot after a newer one.
- Map subscribers fetch everything again when a new session starts, as
  the controller only sends values that exist. A host revoked while a
  browser was disconnected stayed in its list.
- The host token check accepts the same pre-rename tokens as the
  WebSocket, so upgrading a host with such a token does not make it ask
  to join again.

test/controller/routes.js

@@ -221,6 +221,7 @@ describe("controller/src/routes", function() {
 			controller.hosts = new SubscribableDatastore();
 			controller.hostPairing = new HostPairingManager(controller);
 			controller.generateHostToken = Controller.prototype.generateHostToken;
+			controller.verifyHostToken = Controller.prototype.verifyHostToken;
 			controller.wsServer.remoteAddr = req => req.socket.remoteAddress;
 			adminToken = controller.users.signUserToken(controller.users.getByName("test"));
 			playerToken = controller.users.signUserToken(controller.users.getByName("player"));
@@ -478,6 +479,11 @@ describe("controller/src/routes", function() {
 				}
 				assert(controller.hosts.has(hostId));
 			});
+			it("should respond with 200 for a host token from before the slave rename", async function() {
+				const { hostId } = await controller.hostPairing.createHost("Host A");
+				const token = jwt.sign({ aud: "slave", slave: hostId }, controller.authSecret);
+				await assertResponse(await check({ "Authorization": `Bearer ${token}` }), 200, { valid: true });
+			});
 			it("should respond with 401 without a valid host token", async function() {
 				await controller.hostPairing.createHost("Host A");
 				assert.equal((await check({})).status, 401);