05/24 Fix bugs

routes/auth.py

@@ -31,6 +31,7 @@ def login():
         else:
             user = authenticate(username, password)
             if user:
+                session.clear()          # prevent session fixation
                 session.permanent = True
                 # Store a safe subset — never store the password hash in session
                 session["user"] = {
@@ -86,3 +87,11 @@ def change_password_view():
                 error = msg
 
     return render_template("change_password.html", success=success, error=error)
+
+
+@auth_bp.route("/ping")
+@login_required
+def ping():
+    """Keep-alive endpoint for the session timeout warning in app.js."""
+    session.modified = True
+    return "", 204