Changing from a delete to set to null

Matching old implementation. Shouldn't make a difference, but there's probably someone out there checking whether the session is undefined vs. null and doing something different in each case. Blah.