destroy session on requst not res