auth sessions hold onto locked account state

[acobster]

Even after an account is unlocked, the data remains in the session, making it impossible to lift an account lock even by manually deleting it in the db. Auth should always just look at the db and not keep account state in the session.