clear session whenever auth is invalid