CORE-2244 Delete the session token when it's expired

@vksvenkat  put the remove user token code at the end of the method