swapped sessions for shiro sessions - cookie now destroyed on logout