invalidate session after user got an access token