Give all sessions a uniform absolute lifetime of one week

Enforced at restore via a login-time stamp, written only at genuine
logins so the limit stays absolute rather than sliding. The cookie
name rotation logs everyone out once at deploy. Second-factor users
are deliberately not treated worse than password-only ones.

1 files changed, 2 insertions, 1 deletions

diff --git a/lib/authenticated_test_helper.rb b/lib/authenticated_test_helper.rb
index c0ec5f40..8f3a3732 100644
--- a/lib/authenticated_test_helper.rb
+++ b/lib/authenticated_test_helper.rb
@@ -2,5 +2,6 @@ module AuthenticatedTestHelper
   # Sets the current user in the session from the user fixtures.
   def login_as(user)
     @request.session[:user_id] = user ? users(user).id : nil
-  end  
+    @request.session[:logged_in_at] = Time.now.to_i
+  end
 end