might be better to do session.clear, in case we store addition session information related to the user