docs: what a junk logout does

Review 2, N11: a value at _continuum/logouts/<name> that isn't a time
(read as damaged: every token revoked), or one far ahead, refuses every
token of the user, new ones too, until it is replaced. Any member can
write it (finding 10). The rules can't see the value (only that it is
written), so access.md says it, and how it is set right: the user logs
out again by password, or one who manages users revokes its tokens.

1 files changed, 5 insertions, 1 deletions

diff --git a/docs/access.md b/docs/access.md
index 458c2dd..657ab94 100644
--- a/docs/access.md
+++ b/docs/access.md
@@ -115,7 +115,11 @@ curl -H "Authorization: Bearer ct1.…" http://other-node:3000/store
   before aren't taken any more. A token of a node banned or forgotten by the swarm isn't
   taken either. In a swarm without a registry, a token is taken until it expires. The
   user a logout names is its node's word, and a logout no deciding path, even under a
-  strict policy: any member could log any user out. It ends sessions, nothing more.
+  strict policy: any member could log any user out. It ends sessions; and a value there
+  that isn't a time, or one far ahead, refuses every token of the user, its new ones
+  too, until it is replaced: by the user logging out again by password
+  (`POST /auth/logout`), or by one who manages users (`DELETE
+  /admin/users/{name}/tokens`).
 * **What it means to trust**: any member could sign a token for any user, as it could
   write anything as anyone ([`trust.md`](trust.md)). A token is a bearer's: whoever holds it is
   the user until it ends, so it goes over TLS only, as passwords do.