They're session security is hilarious.. a session token is still valid for at least 6 hours after logging out.. even after their humorous advice to close all browser tabs (which as expected doesn't do anything server side)