Expire session on sign out

[mish-tan]

Had someone do a security check on our code base and they flagged this minor issue.

Issue: sign_out does not invalidate the session in the db. If a bad actor gained access to the session cookie they would be able to log in as the user.

To reproduce:

1. Sign in, copy the cookie value for _session_id
2. Sign out
3. Paste the cookie value back into _ session_id
4. Navigate to a page that only logged in users should see

This is because in our code base, we use authenticate_by_session(authenticatable_class) to verify the user is logged in, which checks if the session exists and it is available (not expired). If someone can get the old session_id, they can use it to log in because the old session is not expired.

Fix: Expire the session when the user signs out, so it will not be available if hit again.

[mikker]

Not immediately opposed to it. Have you looked if other libraries do this? Or the built in Rails auth generator?