api/login: add session_destroy