The logout loop nobody tests: treating session cleanup as a security feature

When I talk about auth with other developers, everyone asks about the login flow. Nobody asks about...