Invalidate session when user logs out.