fixed bug when invalidating a session