Always leave the _authentication_token set.

This was added a long, long time ago as a part of the StoreSessionModule
in silverorange/store@64a2853 where CSRF prevention was added for all
sessions that had accounts. It was then later moved to the
SiteSessionModule in commit silverorange/site@1c9b22e. It was at this
point that CSRF was added for all active sessions on the website. We
want the _authentication_token set at all times now so don't unset it
when a logout occurs.