docs: More TODO

README.md

@@ -24,6 +24,9 @@ Compared to lldap, llldap:
 
 We may explore in the future:
 
+- i18n domains (punycode)
+- i18n user identifiers (TODO: check compatibility with other tools)
+- RTL languages
 - hierarchical groups
 - fine-grained permissions (RBAC)
 - running with different async runtimes

src/http/logout.rs

@@ -20,6 +20,8 @@ pub async fn logout(
         login_page(
             State(state),
             Some(LoginError::SessionInvalidated),
+            // TODO: this is wrong because we produce an empty redirect query which is
+            // then converted to b64URL (and panics).
             InternalRedirect::new(),
         )
         .await,