After closing all browser instances, the lp extension comes up logged in when the browser is relaunched.
This is also true after power off / power on of the host.
'log out when all browsers are closed' is selected.
The only way to keep it safe is for the human to remember to log out manually before closing; a fallible proposition...