Just in the process of final testing for an iPad SE browser, and uncovered some odd behaviour.
I'm using Google for authentication. If I deploy a clean version of the app, and authenticate, I get the "Select OpenID provider" screen, with the usual choices -- SE, Google, Facebook and Yahoo. If I enter my credentials, and the app hasn't been authorised, I get the Approve/Reject screen. If I select Approve, the authentication flow completes successfully and I get my token.
But I want to implement a feature by which the current user can log out, and a different user can log in and view their account. If I de-authenticate and invalidate the token, the next time I try to log in again, the "Select OpenID provider" screen appears briefly, but without the four buttons. Then, the page redirects to the Approve/Reject screen, leaving the user without the chance to enter a different set of credentials.
I've cleared the cache and cookies as best I can, so I figured there's the possibility that some kind of caching might be something server-side. As evidence to the contrary, however, if I blow away the app and re-deploy, I get the "select provider" screen again.
Has anyone seen this kind of behaviour, though? Is it expected?
EDIT: Could it be HTML5 Local Storage? The saved credentials seem to persist even through a reboot. Is anyone aware of how Google caches credentials?
Possibly also related to this post.