Clean up Session.destroy/Session.close.

Session.destroy is now folded in to Session.close. Server._closeSession
is renamed to Server._removeSession, since the `destroy()` call inside
`_closeSession` was always a no-op.