I decided not to delete the session because so long as the user is signed in, no matter where they go on the site they'll get a 403 error. If we deleted the user's session, they would be redirected eventually to the sign in page, which has the tempting "register" button at the top.