introduce ISession::destroy() and ensure the session is destroyed on logout