sneak 48827f0eb5 Log out with a form and count logouts instead of timing them (part of #256) ...

Logging out is now a POST in the CSRF-protected route group, sent by a
form on the generator page, so a link or image on another page of the
same site cannot end every login session. The session manager keeps a
count of logouts instead of the time of the latest one: each session
carries the count at its login and is refused once it has changed. No
clock is compared, so a login after a logout always works.

Model: opus-5-5

2026-10-15 16:33:09 +00:00

..

generator.js

Remove unsafe-inline from the Content-Security-Policy (closes #125)

2026-10-04 18:58:40 +02:00

static.go

Remove unsafe-inline from the Content-Security-Policy (closes #125)

2026-10-04 18:58:40 +02:00

style.css

Log out with a form and count logouts instead of timing them (part of #256)

2026-10-15 16:33:09 +00:00