Test that logging out needs the form's CSRF token (part of #256)

A GET /logout, or a POST /logout without the CSRF token, must end no
login session; the generator page must carry a logout form with the
token; and after a logout from that form, a login opens the generator
page while a cookie copied before it is refused, also after a restart.

Model: opus-5-5

internal/session/session_logout_test.go

@@ -124,9 +124,8 @@ func TestLogout_EndsEverySessionMadeBeforeIt(t *testing.T) {
 }
 
 // TestLogout_WithoutSession_EndsNoSession verifies that a logout from a
-// request without a session cookie ends no session. Another site can make a
-// browser request /logout, but the browser leaves the SameSite=Strict
-// session cookie out of that request.
+// request without a session cookie ends no session, so someone who has not
+// logged in cannot end the sessions of those who have.
 func TestLogout_WithoutSession_EndsNoSession(t *testing.T) {
 	t.Parallel()