diff --git a/lib/facebook.js b/lib/facebook.js
index <HASH>..<HASH> 100644
--- a/lib/facebook.js
+++ b/lib/facebook.js
@@ -186,6 +186,7 @@ var destroySession = module.exports.destroySession = function(req, res, clearCoo
 	});
 	
 	if(req.facebook) {
+		req.facebook._setAccessToken(null);
 		delete req.facebook;
 	}
 	clearAllPersistentData(req);
Need to invalid access token in facebook object first in case someone holding a reference to it.