revoke a session when a user logs out.