Steps to reproduce:

1. Follow http://symfony.com/doc/current/cookbook/security/entity_provider.html with the AcmeDemoBundle
2. Load a fixture for the user http://symfony.com/doc/current/bundles/DoctrineFixturesBundle/index.html
3. Login
4. Change the username or password hash behind the scenes in the database
5. Reload the page - the user should be logged out at this point but is not - according to the cookbook article. The user remains logged in and if you changed the username, the updated username comes up in the profiler.

Using Symfony 2.6.4, PHP 5.4.35

Could anyone else please try it and let me know if you experience the same? Thanks.