numist/this-might-be-offensive — Issue #10: cookiehash should include password
Author: numist
Created: 2011-10-12 17:51:52+00:00
State: open

if a use changes their password it should invalidate all issued login cookies.

this should be staged—for a few months if a user comes around with an old style cookie it should be accepted and silently updated to the new format. then we pull the plug on the old style.