sneak 1d2411dd2e Log out with a form and count logouts instead of timing them (part of #256) ...

Logging out is now a POST in the CSRF-protected route group, sent by a
form on the generator page, so a link or image on another page of the
same site cannot end every login session. The session manager keeps a
count of logouts instead of the time of the latest one: each session
carries the count at its login and is refused once it has changed. No
clock is compared, so a login after a logout always works.

Model: opus-5-5

2026-10-15 14:09:16 +00:00

..

migrations

Log out with a form and count logouts instead of timing them (part of #256)

2026-10-15 14:09:16 +00:00