docs: More TODO

src/http/logout.rs

@@ -20,6 +20,8 @@ pub async fn logout(
         login_page(
             State(state),
             Some(LoginError::SessionInvalidated),
+            // TODO: this is wrong because we produce an empty redirect query which is
+            // then converted to b64URL (and panics).
             InternalRedirect::new(),
         )
         .await,