need to invalidate session in database if we can't verify