Deleting expired persistent login cookie for Boost compatibility

yes. this a bug. module not makes cleanup of such dead cookies for client - when they're expired or sessions killed

This is a little bit more complicated that the 5.x patch, as there are a few instances where the cookie needs to be removed and not all call _persistent_login_invalidate()

The instances that this patch addresses are:
- The user logs out (previously worked)
- The user changes their password or deletes their account
- The visitor supplies a conflicting cookie (uid:series is valid, but token not)
- The visitor supplies an invalid cookie (uid:series pair not in database)
- The visitor supplies an expired cookie

The patch could be simplified if the cookie is always removed in _persistent_login_invalidate(), which would address the first three conditions. The second two, however, do not invalidate any tokens in the database and so require a separate call. I do not know how multiple calls to setcookie() are handled though, and other invalidation instances will send a valid cookie later (e.g. when a token is used it is invalidated and then a new one is sent).

This patch works as advertised.

A nice addition would be not setting $_SESSION['persistent_login_check'] = TRUE; for anonymous users, as this gives them a session. In the case where the cookie check fails and they remain anonymous, the cookie is unset, so there's no need to keep track of the fact that you've checked the cookie.

Here's a patch with some more substantial changes; simplifying the setcookie function, adding a clearcookie function, and only setting the 'checked' session variable if the login is successful.

You can view the 3 individual commits in the patch at https://github.com/gapple/persistent_login/tree/issue/943280-remove-inva...

Bumping version; needs a 7.x-1.x patch

Closing out 7.x issues