freedomofpress/securedrop — pull request #354 by bwillis (2014-04-17 03:55:53+00:00)
Title: Fixes #353: When the session identifier is changed, logout the user

When on the source generate page, the codename is regenerated on each
request. If the user had a previous session codename is it overwritten,
but they are still considered logged in. If they attempt to hit that
page again the session will be looked up because they are logged in.

This approach ensures that the user is logged out when regenerating the
codename by destroying the logged_in flag in the session.