destroying sessions does not send the set-cookie header twice