logic to invalidate session on logout