Add a method for nuking a session.

This probably needs calling in a few places, especially when the currently logged in user changes while the session is hanging around.

htdocs/auth/session.php

@@ -219,6 +219,24 @@ class Session {
         }
     }
 
+    /**
+     * Destroy a session
+     */
+    public function destroy_session() {
+        if ($this->is_live()) {
+            $_SESSION = array();
+            if (isset($_COOKIE[session_name()])) {
+                setcookie(session_name(), '', time() - 65536,
+                    ini_get('session.cookie_path'),
+                    ini_get('session.cookie_domain'),
+                    ini_get('session.cookie_secure'),
+                    ini_get('session.cookie_httponly')
+                );
+            }
+            session_destroy();
+        }
+    }
+
     /**
      * Find out if the session has been started yet
      */