auth: Ensure session token is cleared on logout

### Outstanding
  * [ ] Session tokens seem to get stuck (like from session timeout). They need to be cleaned up when no longer valid