set session to null after invalidating it