Yes, it should be done in the visitor.

The method should return a dedicated object (`SessionDeleted` sounds about right, since we already have `SessionCreated`. A Visitor must be added, with the  matching service tag, mapped to this class. Then the visitor can build the HTTP Response.

Does it all make sense ? See https://github.com/ezsystems/ezpublish-kernel/commit/1835a9c26d43cb80e01702baf52c7380bdb2ae5d for an example.