correct placement of session.invalidate()