<?php
require_once __DIR__ . '/config/database.php';
if (!empty($_SESSION['user_id']) && $pdo) {
    // Clear the active session token so this device can't silently stay "logged in"
    $pdo->prepare("UPDATE users SET active_session_token = NULL WHERE id = ?")->execute([$_SESSION['user_id']]);
}
$_SESSION = [];
session_destroy();
header('Location: login.php');
exit;
