No way to expire existing sessions

[Francis J. Lacoste]

We currently set the session lifetime to 1h. This basically means that we have to do the OpenID dance several time a day for sites that are protected using this module. This is significant friction. But since there is no way to revoke existing sessions, it's the only way to enforce security.

There should be a way to either selectively force a new session, or a way to trash all sessions. That would enable us to raise the default session lifetime.

[Robert Collins (lifeless)]

Concretely we need to solve this use case: "person with privilege leaves the team". One way would be to have a means to reset all the nonces, so that everyone logs in again. E.g. this might be as simple as 'apachectl restart'.

Once we have this, we can increase the nonce lifetime for Canonical apacheopenid sites, which will make many folk happy happy happy.

[William Grant (wgrant)]

Expiring the mod_python session cache is probably sufficient here, although bug #652877 suggests that team memberships are cached elsewhere.

In the default configuration (eg. devpad), 'rm /tmp/mp_sess.dbm' should work fine.