I can only provide verification of the counter example. Having worked on some VERY large web services, the session was tracked on the back end and instantly an

I can only provide verification of the counter example. Having worked on some VERY large web services, the session was tracked on the back end and instantly and trivially revocable.