<?php
// FIX Bug 8: setcookie() was passed an array as arg #4 which fails on PHP < 7.3
// Now uses separate named params, compatible with all PHP 7+ versions
csrf_check();
audit('logout');
$_SESSION = [];
if (ini_get('session.use_cookies')) {
    $p = session_get_cookie_params();
    setcookie(
        session_name(),
        '',
        time() - 42000,
        $p['path'] ?? '/',
        $p['domain'] ?? '',
        (bool)($p['secure'] ?? false),
        true
    );
}
session_destroy();
json_ok([], 'Logged out');
