[patch] Expire trac_auth_session cookie before calling LoginModule._do_logout

Expire cookie trac_auth_session before calling LoginModule?._do_logout

(In [10591]) AccountManagerPlugin: Expire session cookie before calling _do_logout(), refs #9088.

We need to do cookie expiration before, since this method will redirect internally and never return, if the logout.redirect option is set in metanav section of trac.ini (available since Trac 0.12).

Ah, I forgot to give you proper credit in the commit message. Sorry, no done by intention, just in a rush to fix it up. Thanks for spotting this and reporting here anyway.

Replying to hasienda:

Ah, I forgot to give you proper credit in the commit message. Sorry, no done by intention, just in a rush to fix it up. Thanks for spotting this and reporting here anyway.

No worries, thanks for a quick commit!

By the way, cookie trac_auth_session still does not get expired properly. Instead of being expired in _do_logout, the cookie gets extended again when the user logs out. I figured that the code that extends it inside _get_name_for_cookie gets called somehow, probably after _do_logout.

I have been looking into it but I haven't found the exact cause yet.

(In [10606]) AccountManagerPlugin: Another (final?) fix to session cookie handling, refs #8927, #9088, #9095 and #9099.

Overriding the supplemental method _expire_cookie() looks saner than overriding (super method) trac.auth.LoginModule._do_logout() and still calling it later on as well.

Thanks to janakj for another non-trivial contribution.

(In [10618]) AccountManagerPlugin: Publish maintenance release 0.3.2, closes #9051, #9082, #9088, #9091, #9092, #9093, #9095, #9099, #9107, #9108 and #9109.

This is an update for current stable at 0.3.1 with a number of fixes for issues reported within the last weeks.

While they will go into acct_mgr-0.4 too, current code isn't ready for release yet and will introduce a number of backwards-incompatible changes. So don't hurry for acct_mgr-0.4 right now.

Just noticed what I'd call a bug in signatures.py and removed unreasonable dependency on identical absolute path for successful check. Looks like nobody else tried this by now, right? Hey folks!

(In [11086]) AccountManagerPlugin: Ensure sensible browser cookie lifetime setting, refs #8927, #9088, #9095, #9099 and #9547.

I think this is now the most intuitive setting of default cookie lifetime: auth_cookie_lifetime from section [trac] gets overwritten with AcctMgr default (30 d) as long as it's found equal to the Trac default (0).

Remember, that the AcctMgr feature still has to be switched on with the boolean option persistent_sessions, that defaults to False, if unset.

(In [11100]) AccountManagerPlugin: Refresh cookie value, refs #9088 and #9547.

New option cookie_refresh_pct determines, how often cookie ID's will get changed on average.