A logout flow should prevent another person using the same device from resuming the prior authenticated session. What should be validated?

1. Only that the logout button becomes gray
2. Only that the application's logo reloads
3. Session invalidation and appropriate post-logout behavior
4. That the session ID is copied into a public bookmark