Session destroy is now handled by the security component.