_session.loggedIn never set to false or deleted?

[curran]

Hello,

I am using GitHub OAuth on derby-login v1.1.1 . Authentication seems to work correctly after I access /auth/github. However, logging out does not seem to work. I tried /auth/logout and /auth/github/logout. None of these seem to set _session.loggedIn to false or delete it.

I noticed that the logout function deletes the user id on the Express session object

derby-login/lib/api/logout.js

Line 2 in 074eac3

delete req.session.userId;

However, I'm not seeing where this change gets propagated to the Derby side, the part accessed by model.get("_session");

Am I missing something? Any suggested ways to achieve logging out? Thank you.