this should probably just be `delete req.session.username`