When the generator ships with 1.6 and has docs, I wonder if it’s worth writing a couple of paragraphs around that and also giving a number of real life examples where an “active” field can’t be used as a replacement for session based access.
For something as important as this, the more explicit you are the better, especially since if you don’t spend a lot of time thinking this through it could be easy to talk yourself into thinking an active field could do the job so you may decide to abort the idea of saving it server side.
Edit: To add another potential real life use case, maybe you accidentally forgot your tablet somewhere and you’re not in a position to immediately get it back (left it on a train, etc.) but you want to sign yourself out of a bunch of sites to avoid a potential future headache.
