reauthentication always clears session