silverorange/site — pull request #41 by charleswaddell (2013-12-10 20:59:08+00:00)
Title: Always leave the _authentication_token set.

This was added a long, long time ago as a part of the StoreSessionModule
in commit silverorange/store@64a2853faa8eada53ab766b81391f1a10825667a where CSRF prevention was added for
all sessions that had accounts. It was then later moved to the
SiteSessionModule in commit 1c9b22e6dbb767946f7ef5e3cc6c59384c728b22. It was at this point that CSRF was
added for all active sessions on the website. We want the
```_authentication_token``` set at all times now so don't unset it when a
logout occurs.