We need to ansure the access_time parameter is in valid range to avoid
possibility of remotely extending session validity.
Signed-off-by: Michal Čihař <michal@cihar.com>
- add separate script for handling logout
- no longer require old_usr for all authentication methods
(this avoids potential information leak)
- require valid token for logout
Signed-off-by: Michal Čihař <michal@cihar.com>
