Destroying a session returns an empty auth header