Make bmcweb pass REQ_POST_CREATE_TO_MEMBERS_PROP

The Members property within resources is expected to allow create in the
same way the Collection resource does.  From the spec:

Submitting a POST request to a resource collection is equivalent to
submitting the same request to the Members property of that resource
collection. Services that support the addition of Members to a resource
collection shall support both forms.

Related: #192

Tested:
Redfish protocol validator, REQ_POST_CREATE_TO_MEMBERS_PROP now passes.

Signed-off-by: Ed Tanous <[email protected]>
Change-Id: I5c22325946eab9aec8c690450aa2ea24a6e4e485

include/authorization.hpp

@@ -247,6 +247,8 @@ static std::shared_ptr<persistent_data::UserSession>
     {
         if ((url == "/redfish/v1/SessionService/Sessions") ||
             (url == "/redfish/v1/SessionService/Sessions/") ||
+            (url == "/redfish/v1/SessionService/Sessions/Members") ||
+            (url == "/redfish/v1/SessionService/Sessions/Members/") ||
             (url == "/login"))
         {
             return true;

redfish-core/lib/redfish_sessions.hpp

@@ -273,7 +273,7 @@ inline void requestRoutesSession(App& app)
         .privileges(redfish::privileges::getSessionCollection)
         .methods(boost::beast::http::verb::get)(handleSessionCollectionGet);
 
-    // Note, the next route technically doesn't match the privilege
+    // Note, the next two routes technically don't match the privilege
     // registry given the way login mechanisms work.  The base privilege
     // registry lists this endpoint as requiring login privilege, but because
     // this is the endpoint responsible for giving the login privilege, and it
@@ -282,6 +282,10 @@ inline void requestRoutesSession(App& app)
         .privileges({})
         .methods(boost::beast::http::verb::post)(handleSessionCollectionPost);
 
+    BMCWEB_ROUTE(app, "/redfish/v1/SessionService/Sessions/Members/")
+        .privileges({})
+        .methods(boost::beast::http::verb::post)(handleSessionCollectionPost);
+
     BMCWEB_ROUTE(app, "/redfish/v1/SessionService/")
         .privileges(redfish::privileges::getSessionService)
         .methods(boost::beast::http::verb::get)(handleSessionServiceGet);