session.abandon (for logout only, session.removeall is ok everywhere else)