Give all sessions a uniform absolute lifetime of one week

Enforced at restore via a login-time stamp, written only at genuine
logins so the limit stays absolute rather than sliding. The cookie
name rotation logs everyone out once at deploy. Second-factor users
are deliberately not treated worse than password-only ones.

1 files changed, 1 insertions, 0 deletions

diff --git a/test/controllers/sessions_controller_test.rb b/test/controllers/sessions_controller_test.rb
index 62acd28a..86da0e61 100644
--- a/test/controllers/sessions_controller_test.rb
+++ b/test/controllers/sessions_controller_test.rb
@@ -9,6 +9,7 @@ class SessionsControllerTest < ActionController::TestCase
     post :create, params: { login: 'quentin', password: 'monkey' }
     assert session[:user_id]
     assert_response :redirect
+    assert session[:logged_in_at].present?
   end
 
   def test_should_fail_login_and_not_redirect