tidy, change Persona callback to https, add session cleanup