remove_session: Fix returning of number of deleted records.
Fix SLO using SOAP binding.

Since the session_id isn't available through the idpauthn cookie,
it must be looked up using the username (derived using NameID).