don't unlink session key

because session keys have an infinite lifetime, keep it until the user
revokes it. This removes the need for application authentication except for the first time the application is run (or if session gets removed some other way)