I came here to start a thread to say what you did, Skye. That's a good explanation. This is one reason why it's important not to click on the "keep me signed in" or "trust this device" on anything but truly trusted devices. Cached auth tokens don't expire immediately.