AuthHandler clears username correctly, sessionKey -> sessionCookie