access: an ended session recorded until the login's end

Review 4, F7: `DELETE /auth/session` recorded the session as ended until the
`session_exp` of the token it came with. A token handed to another member's dashboard
has its `session_exp` cut to its own end (five minutes), and so has the session that
dashboard keeps with it: logging out there recorded an end minutes away, the next
remake's snapshot left it out, and the original browser's tokens of the same session,
refreshable for days, were taken again.

A token now keeps the login's end as it logged in (`Claims::login_exp`), which no
refresh changes, and an ended session is recorded until then (or the token's
`session_exp`, if later, as for a token from before the field).

0 files changed, 0 insertions, 0 deletions