Fingerprints the credentials that authenticate portal sessions — the password
hash and the sorted Google allow-list — keyed by the session secret. It is
embedded in each issued session and re-checked on every request, so rotating
the password (a new hash, even for the same password) or changing the
allow-list changes the fingerprint and evicts every prior session. Email order
is normalized by code point (locale-independent) so a mere reordering does not
needlessly log everyone out, and an identical config fingerprints identically
across hosts.
Fingerprints the credentials that authenticate portal sessions — the password hash and the sorted Google allow-list — keyed by the session secret. It is embedded in each issued session and re-checked on every request, so rotating the password (a new hash, even for the same password) or changing the allow-list changes the fingerprint and evicts every prior session. Email order is normalized by code point (locale-independent) so a mere reordering does not needlessly log everyone out, and an identical config fingerprints identically across hosts.