session destroy sets cookie to {} and catch JSON.parse and decrypt errors