On logout, the HTTP session should be destroyed

Since it might contain sensitive information relevant to the user that's logging out, sessions should be destroyed in order to prevent any information leak.