Authentication TODO

[nadnoslen]

• [x] Logout Action
• [x] Refresh token expiry should prevent access token refreshes but it doesn't
• [x] Blacklist a refresh token
• [x] Do we store the session creation payload in the user table
• [x] Do we keep a history of sessions? Store host name, browser name, and browser signature?

[nadnoslen]

Interesting: https://guides.rubyonrails.org/active_record_postgresql.html