Don't reset a user's password salt on logout

Doing this will invalidate all current login cookies, which works
splendidly if the user is logged in from only one browser at a time.
However, we don't want a logout in one browser to affect all others.

There is a theoretical security risk in doing this, in that if an
attacker gains access to a login cookie, that cookie will still be
valid after the user logs out. This should be solved in a different
way that doesn't interfere with basic functionality.

http://forum.tfes.org/index.php?topic=1894