Login button visible with private resource using nss #78

Not yet sure if this requires a solid-ui, auth, or NSS solution.

This is adding more detail to:
https://github.com/solid/solidos/issues/70#issuecomment-940146896
"On NSS : Login to server-root, on your pod, click on the goto link of a private container. The opened page will show you as logged out but it will also show you private resources."

I have the problem happening sometime after having logged in (possibly days?) when I use a bookmark to go straight to a private resource.

It looks like the problem can occur simply because UI.authn.authSession.info.isLoggedIn=false even when an NSS cookie is set and therefore private access is indeed possible.

To replicate:

1. Go to a private resource on solidcommunity.net
2. Login
3. Delete all localStorage but keep cookies
4. Refresh page
5. Private resource is shown and editable but login button is also shown and UI.authn.authSession.info.isLoggedIn=false

If loggedIn status was based on wac-allow it would be correct, but also dependent on the resource being viewed.

I haven't checked but my guess would be that solid-client-authn-browser relies on the redirect dance to determine logged in status and this is somehow able to be bypassed when the cookie is used??

One fix for the UI to be correct would be to clear the cookie if UI.authn.authSession.info.isLoggedIn=false ...

Edit: isLoggedIn gets set by the redirect handler
https://github.com/inrupt/solid-client-authn-js/blob/287f3b8b89d7b0cfb94c8dc251d51eb5380b6412/packages/browser/src/login/oidc/redirectHandler/AuthCodeRedirectHandler.ts#L222
If checkuser fails in solid-ui, mashlib still tries to render the subject using outliner from solid-panes, which succeeds in fetching it as if it is a public resource because the cookie allows it.

Reproduce the sequence on solidcommunity.net: open a private resource, log in, remove localStorage while retaining cookies, and refresh. Read AuthCodeRedirectHandler.ts around the referenced redirect-handler line, then trace solid-ui's checkuser path and mashlib's use of the solid-panes outliner. Done means private content remains accessible only as intended and the login button accurately reflects the session state.