auth session: delete()