`_logout()` wipes `request.session`.