warn when secret data is sent insecurely
better file names
removed debug statement
don't intercept session invalidation in base authenticator
reload application after logout
no need to support setting applicationRootUrl manually
cleanup
session invalidation callbacks will be invoked anyway
cleanup
fixed example middleware
don't pollute the application route
fixed docs