invalidate the session after logout

Signed-off-by: Yuan Cao <mail@caoyuan.me>