login: a token asked to live less ends its session with it

Review finding 8, first part: a refreshed token's lifetime came from
the refresh request, and it kept the session's end. So the five-minute
read-all token a dashboard hands to another member's refreshed into a
12-hour one, renewable for seven days.

A token asked to live less (`lifetime`, at login or refresh) now ends
its session with it: nobody refreshes it past its end, its holder
included, and a session begun from it (POST /auth/session) ends then
too.

1 files changed, 3 insertions, 2 deletions

diff --git a/docs/access.md b/docs/access.md
index 7c576b0..a3b8864 100644
--- a/docs/access.md
+++ b/docs/access.md
@@ -100,8 +100,9 @@ curl -H "Authorization: Bearer ct1.…" http://other-node:3000/store
 * **How long**: `--token-lifetime` (12 hours), refreshed (`POST /auth/refresh`, on any
   node, which signs the new one) until `--session-lifetime` (7 days) after the login;
   then the user logs in again. A refreshed token may say less (`limit`), never more,
-  and live less (`lifetime`, in seconds): a dashboard opening another member's hands it
-  one reading only, for five minutes ([`dashboard.md`](dashboard.md)).
+  and live less (`lifetime`, in seconds), and then ends its session with it: nobody
+  refreshes it past its end. A dashboard opening another member's hands it one reading
+  only, for five minutes ([`dashboard.md`](dashboard.md)).
 * **Revoking**: a user disabled or removed is refused at once; all of a user's tokens,
   by the user (`POST /auth/logout`) or by one who may manage users (`DELETE
   /admin/users/{name}/tokens`), which sets `_continuum/logouts/<name>`: tokens issued