This avoids putting the authentication token into a command-line
argument to launch the browser, where it's visible to other users.
Filesystem permissions should ensure that only the user who started the
notebook can use this route to authenticate.
Thanks to Dr Owain Kenway for suggesting this technique.
- stat() the file once and reuse the result to save on syscalls. Not as
good as using scandir(), but should still help.
- Don't re-check if parent directories are hidden for each file in the
directory.
Could do with testing on Windows.
os.path.samefile is available everywhere but Windows + py2.
Backporting the py3 implementation doesn't work because
`os.stat` on Windows py2 returns 0 for st_ino and st_dev,
which will always be equal.
In this case, use case-insensitive path comparison, plus full-stat comparison (times included).