Currently, audit logs contain both authenticate and logout events which, with effort, allow a system administrator to recreate a picture of all connection sessions by correlating record UUIDs to describe login->logout history.  We can do better, by including the authentication time with the logout event, simplifying audit log review processes.