only clean the session variable if the user is not authenticated anymore