This was mostly addressed in c47c4e2 however if a view doesn't make a REST API it will seem as if everything is ok and the user is still logged in until they happen to hit a view that tries to retrieve something. Perhaps every state change should "check-in" with the server in some way, ideally using minimal bandwidth. Another idea is to have some periodic check-in that could re-direct on session expiration.