login: add session_destroy() first