I had only one account on my MBP. I created a new account on it for my son and he has his own password.
I was logged-in with an open session on my account. I closed the lid and left it there, unplugged. Eventually it shut down due to a low battery.
My son plugged it in and it restarted. It asked for his password to login on his account but when he validated the credentials, instead of opening his a new session for him it reconnected him to the last active session; my session on my account.
I have security concerns with how this worked. I believe macOS should've created a new session matching my son user credentials when it restarted but it didn't.
Is this normal behaviour? How can I prevent this from happening in the future?