Thorough session destruction, update README/TODO

@pmjones if session_destroy is called, all the session data will be lost. 

Say if I have added the message "You have successfully logged out." . Isn't we just need to unset the session rather than calling session_destroy itself?