destroy session on sign out; not only user data;