no longer destroy sessions

@pmjones I agree you don't need to destroy the whole session with `session_destroy();` . But the cookie should be destroyed if it is created.