delete the auth token correctly after validating it