Logout

Clear the session cookie.

Cookie deletion only, not server-side revocation -- there is no session table; a session is a signed, timestamped token verified purely from the signing key. A token copied off this browser before logout stays valid until it expires (:data:SESSION_MAX_AGE_SECONDS) or the signing key rotates (only :func:change_password does that). Deliberate trade-off: no server-side session store on a single-account device with no database of its own.