Log out mechanism for clearing ds_actor cookie

[simonw]

Need a cookie clearing mechanism and a way to show that you are logged in.

datasette-auth-github had a solution for this that can be pulled into core.

[simonw]

I don't like how this often involves a logout link that can be maliciously activated.

I'm going to use a CSRF protected form button styled to look like a link instead.

[simonw]

Another problem: what to display in the "you are logged in as", since we don't dictate an actor design.

I'm going to use a includes template for this that can easily be over-ridden by administrators or by plugins.

The default will look for the first available of the following keys:

• display
• name
• username
• login
• id

[simonw]

Step one: a "logout" page at /-/logout - which shows you a single CSRF-protected "logout" button if you do a GET against it and logs you out if you do a POST against it.

[simonw]

Now just need the "Logged in as: XXX <logout>" navigation item.