I reckoned, but wouldn't you say that this security measure should be part of the lib?
Another question: in your test controller (auth.php), when a user changes password you call $this->logout(). Not doing this and simply refreshing session data (to reflect the change if necessary), is that considered bad practise? I just think lots of users are used to staying logged in after having changed their passwords. Comments on this?
