Credential expiration logic placement in Meteor Accounts: publish/subscribe guard versus method checks
Meteor's Accounts package supplies password and OAuth login methods but does not enforce credential expiration natively, requiring applications to implement validation logic. The Accounts.validateLoginAttempt hook offers a point of interception for checking credential validity before session establishment. A persistent design question involves whether expira