* `PublicSessionController create` receives a share token.
* The others receive the parameters for a text session:
`document_id`, `session_id`, `session_token`.
Even though these are relatively short lived
they could be used to retrieve content from the document when leaked.
Signed-off-by: Max <max@nextcloud.com>
95a674e238