Delete username/password from session on logout

I was seeing this error sometimes (i.e. after logging out):
```
[error] Cannot select user (sql: no rows in result set)
```
AuthenticateUser was getting called with empty strings for username password, because the logout function was setting them as such. So here it is changed to delete them from the session map, so they are nil and we don't try to authenticate them.