Move session invalidation to its own method.