fix bug - 'log out' works only sporadically

- logout action results in a req.session.destroy call, which in turn
calls the session.delete method. But the tos-sessionStore module was not
waiting for session to be deleted before returning, which was causing a
timing issue with the new request finding an active session that was yet
to be deleted.