User able to surpass LDAP group requirement with a cookie

[Dom-nik]

I've just noted that after enabling LDAPAuthenticator.allowed_groups, one user who was not included in the application group was still able to login, probably based on a cookie/browser cache. When the user tried to login from within a private window it didn't succeed, but with a regular browser window login was not required. It seems to be a (minor) security breach.

[yuvipanda]

Yep - all cookies signed prior to enabling this would probably still be valid. I think rotating the secret key (jupyterhub_cookie_secret file) should fix it.

Thanks for reporting it! I'll add this to the README!