rename $tmp to $invalidateSession