phatworx/devise_security_extension — pull request #59 by klobuczek (2013-08-19 20:30:25+00:00)
Title: removal of unique_session_id on explicit user logout

This change cleans up the unique_session_id from the db when the user logs out. This was necessary as our security department objected that if the user logs out, but the response for some reason doesn't reach the client, or the response is maliciously intercepted, or the browser (or modification of it) doesn't properly invalidate the cookie, or the cookie has been copied before logout, the system can still be accessed using the cookie.

I had to add the conditional to preserve the current behavior of the gem.