public static void logoffUser(final AuthenticationSession session) {
LOG.info("log off user " + session.getUserName());
IsisContext.closeSession();
getAuthenticationManager().closeSession(session);
final AnonymousSession replacementSession = new AnonymousSession();
IsisContext.openSession(replacementSession);
}