removed auth session (tokens stay valid until expired)