use signed cookies directly vs. accessing session:

* this addresses an issue where certain session
  stores would not logout properly via the
  `reset_session` call.