Exactly - they can close the session,  but keep the authentication token.  Thanks for pushing on this - as wila mentioned, it's really annoying that you can start to reply when not logged in, and then lose the text you've written when it prompts you to authenticate.