feat: harden the myep OAuth2 login

config/packages/security.yaml

@@ -1,4 +1,9 @@
 security:
+    # Symfony's default, stated because it is a decision: the session id is regenerated on a
+    # successful login, so a session id an attacker planted beforehand is not the one that ends
+    # up authenticated.
+    session_fixation_strategy: migrate
+
     # No password_hashers: there are no passwords here. Authentication is OAuth2 against myep,
     # which owns the credentials; ephub only ever sees a userinfo response.
 
@@ -19,9 +24,20 @@ security:
             entry_point: App\Security\LoginEntryPoint
             custom_authenticators:
                 - App\Security\EpAuthenticator
+            # The local lockout. Roles follow myep on every login and a deleted row is simply
+            # provisioned again, so this flag is the only thing here that myep cannot undo.
+            user_checker: App\Security\UserChecker
             logout:
                 path: app_logout
                 target: app_login
+                # Without this any third-party page can log somebody out by embedding the URL.
+                # The header link is a form POST for the same reason.
+                enable_csrf: true
+                # Local only: there is no RP-initiated logout against myep and no token
+                # revocation, so this ends the ephub session and nothing else. It matters less
+                # than it usually would -- myep destroys its own session immediately after an
+                # external authorization request, so there is normally no SSO session left to
+                # end -- and the access token is gone either way, never having been stored.
 
     access_control:
         # The login surface itself has to stay reachable, or the entry point redirects in a loop.