Remove User session key on unauth
Remove User session key on unauth

Was introduced in order to tackle a defect whereby directly hitting
login when the session has expired led to leakage of the Gt.User key
(set from the user pagetool's cookie and added to the NEW session).

I don't think this caused a security issue, but it was apparent from
the Dummy auth login process.  Not sure why the test only just started
failing...

8w/PHP.Gt,8w/PHP.Gt,8w/PHP.Gt,8w/PHP.Gt