FIX: Improve token rotation and increase logging

- avoid access denied on bad cookie, instead just nuke it
- avoid marking a token unseen for first minute post rotation
- log path in user auth token logs

spec/components/auth/default_current_user_provider_spec.rb

@@ -208,15 +208,7 @@ describe Auth::DefaultCurrentUserProvider do
   end
 
   it "correctly removes invalid cookies" do
-
     cookies = {"_t" => SecureRandom.hex}
-
-    (Auth::DefaultCurrentUserProvider::MAX_COOKIE_MISSES).times do
-      provider('/').refresh_session(nil, {}, cookies)
-    end
-
-    expect(cookies.key?("_t")).to eq(true)
-
     provider('/').refresh_session(nil, {}, cookies)
     expect(cookies.key?("_t")).to eq(false)
   end