Session api, logout using invalidate