fix: limit end_session to the users own sessions

src/auth/session.rs

@@ -61,8 +61,9 @@ impl Sessions for User {
 
     /// End a user session
     async fn end_session(&self, id: &str) {
-        sqlx::query("DELETE FROM user_session WHERE id = $1")
+        sqlx::query("DELETE FROM user_session WHERE id = $1 AND \"user\" = $2")
             .bind(id)
+            .bind(&self.username)
             .execute(get_pg!())
             .await
             .unwrap();