Call /admin/bye on logout

management/auth.py

@@ -147,7 +147,7 @@ class KeyAuthService:
 
 	def remove_user_token(self, email, request, env):
 		# Remove the user's token from the in-memory session database.
-		# Returns the invalidated token if exists.
+		# Return the invalidated token if exists.
 		return KeyAuthService.__token_dict.pop(email)
 
 	def create_user_key(self, email, env):

management/daemon.py

@@ -184,7 +184,7 @@ def bye():
 		pass  # Unauthorized users can logout too, simply do nothing.
 	finally:
 		resp = Response()
-		resp.set_cookie("miab-cp-token", expires=0)  # Removes the token cookie
+		resp.set_cookie("miab-cp-token", expires=0)  # Remove the token cookie
 		return resp
 
 # MAIL

management/templates/index.html

@@ -372,6 +372,7 @@ function do_logout() {
     localStorage.removeItem("miab-cp-credentials");
   if (typeof sessionStorage != 'undefined')
     sessionStorage.removeItem("miab-cp-credentials");
+  api("/bye", "GET");  // Invalidate and remove control panel token.
   show_panel('login');
 }