nuke the session cookie on logout