simple session auth cleanup