Added note on session.invalidate() and leftover cookie