session states should be cleared on logout