fix: undo no longer fails with a 400 in a signed-in browser

Undo ends every session of the user, including the one that opened the link; saving that deleted session at the end of the request made Django answer 400 although the address had been restored. The view now drops its own session (as sign-out does), also on the unclear-outcome page. Tests for both cases from a signed-in browser.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FocPJ75XPma7TcuYEMy8zm

portal/profile/views.py

@@ -266,5 +266,18 @@ def email_undo(request, token):
     except DirectoryUnavailable:
         return _unavailable(request)
     except services.OutcomeUnknown:
+        _drop_own_session(request)
         return render(request, "profile/email_unknown.html", status=500)
+    _drop_own_session(request)
     return render(request, "profile/email_undone.html")
+
+
+def _drop_own_session(request):
+    """Undo ends every session of the user, also the one that opened the link.
+
+    Its row is gone, so saving it at the end of the request would fail with a 400; flushing it
+    clears the cookie instead.
+    """
+    session = getattr(request, "session", None)
+    if session is not None:
+        session.flush()