clean up the session after authentication