Session.invalidate

Kill the current session. It wipes out the disk file and memory, and changes the session ID.

You should do this if the user's authentication info changes at all.