> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://fastpix.com/docs/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://fastpix.com/docs/_mcp/server.

# Session security: multi-browser validation and single-token enforcement

> Auth sessions now validate against a stored fingerprint, reject parallel logins across browsers and rotate tokens on password change.

We tightened session handling after a support case where an admin's old browser tab continued holding a valid token after a password rotation.

* Added `multiple browser auth validation` so two simultaneous sessions for the same user are reconciled, not silently allowed.
* Implemented `single auth token validation` to ensure only the most recently issued token is honoured.
* Resolved the `invalid session` 400 issue that surfaced during quick consecutive logins.
* Fixed the "admin login" regression and reinstated correct session validation for staff accounts and forgot-password flows.