// user was deleted/disabled during session
HttpServletResponse response = ((WebResponse) getRequestCycle().getResponse())
.getHttpServletResponse();
app().authentication().logout(response, user);
session.setUser(null);
session.invalidateNow();
return;
}
// validate cookie during session (issue-361)
if (user != null && app().settings().getBoolean(Keys.web.allowCookieAuthentication, true)) {