server: clean up session IDs