The remember_login cookie is currently backed by an OAuth refresh token, which is used to reauthenticate the user with MetaBrainz (MeB) when the standard session cookie expires. The idea behind using a refresh token was to prevent authentication in cases where MB access was revoked on MeB, or where the account was blocked on MeB.

An issue with this implementation is that it requires locks to prevent refresh token reuse, to handle cases where the user opens many tabs at once. In some cases, acquiring the lock can fail, and there are other failure cases which I believe are not handled properly which can still lead to token reuse. If this occurs, MetaBrainz will revoke other tokens for that client/user as a security measure, triggering a logout.