One session across sites

The session is a short-lived signed token that carries a version number, so changing your password ends every session at once. A refresh cookie renews it. The cookie is replaced each time it is used, and it keeps extending while you keep using it. A central cookie that belongs to the hub alone lets a sister site ask the hub whether you are signed in, and if the hub cannot answer, the site treats you as signed out. The list of sites a sign-in may return you to comes from the hub's registry of sites, and it only ever grows. Logging out is a full page navigation, so every site's cookie is cleared.