gbirke/rememberme — pull request #3 by bartosz-maciaszek (2014-09-22 13:14:00+00:00)
Title: Call cleanTriplet() on successful login. "expires" column was not checked in SQL

Hi,

According to http://jaspan.com/improved_persistent_login_cookie_best_practice, "If the triplet is present, the user is considered authenticated. The used token is removed from the database. A new token is generated, stored in database with the username and the same series identifier, and a new login cookie containing all three is issued to the user.". This was not being done in Authenticator.

Additionally, I added SQL condition for the token expiry date column. Without it, the user could have been autenticated using expired token, which is bad.

Please have a look and merge if it's OK.

Regards,
Bartosz