set req.session.user to undefined in AuthController/logout