Node.js OTP Defense: List User Sessions and Revoke One Safely

Treat a session inventory as an abuse-control surface, not an account-history page: store server-side...