wipe_sessions is already implemented

although not automatically called from anywhere...
add TODO section