Invalidate session cookies when changing the private code

[zorun]

Since recently, changing the private code is a way to remove access to previous members: it prevents people from logging with the old private code (obviously) but also with the old token (e.g. in invitation links).

However, if a previous member still has a valid cookie, he/she may still be able to login anyway. We should check if it works, and if yes, fix this issue.

[almet]

Interesting :-)

I confirm that this is a problem : changing the project code doesn't invalidate the cookies. One way to mitigate this would be to include something derived from the project code in the cookie, and checking against it when checking the cookie.

[zorun]

While reviewing our security doc, I got reminded of this. Indeed, it's a problem!