Shouldn't the session cookie also be removed?