It kind of feels like the people designing and building these systems need to go out of their way to get this wrong. I mean, can't they just put a timeout on the session cookie? Then when the user revisits the site, the cookie won't be sent, and they won't be treated as logged in? What are they doing instead? 2/2