Right now every authenticated user can list all sessions and remove them. It has to be obvious that something extra has to be done to protect it.
Right now every authenticated user can list all sessions and remove them. It has to be obvious that something extra has to be done to protect it.