FIX: destroy session cookie