Exercise 3: Why Rotating SECRET_KEY Logs Everyone Out — Possible Solution
====================================================================

WHAT SECRET_KEY ACTUALLY DOES
------------------------------
Per this chapter, SECRET_KEY is what signs session cookies (and every CSRF token Chapter 8's own {% csrf_token %} generates) - a session cookie's validity is verified by checking its signature against the current SECRET_KEY, not just by checking that some cookie value exists.

WHY CHANGING IT INVALIDATES EXISTING SESSIONS
------------------------------
Per this chapter, because SECRET_KEY is what actually signs session data, changing it means every session cookie that was signed with the OLD key no longer matches a signature check performed against the NEW key. Every existing session - including the admin account imported back in Chapter 9 - becomes invalid at once, the moment the key changes, since Django can no longer verify that those old, still-in-a-browser session cookies were legitimately issued by this application.

WHY THIS ISN'T A BUG
------------------------------
Per this chapter, this is a direct, expected consequence of what the key actually does, not a sign that something went wrong - it can be a surprising "why am I suddenly logged out" moment the first time it's experienced, but it's the correct, intended behavior of session signing working exactly as designed.

WHY THIS WORKS AS AN ANSWER
------------------------------
It correctly explains that SECRET_KEY signs session cookies (and CSRF tokens), correctly explains that changing the key invalidates the signature check for all existing sessions including the Chapter 9 admin account, and correctly frames this as expected behavior rather than a bug.