title: Why is PassportJS in Node not removing session on logout
body: <p>I am having trouble getting my system to log out with PassportJS. It seems the logout route is being called, but its not removing the session. I want it to return 401, if the user is not logged in in specific route. I call authenticateUser to check if user is logged in.</p>
  
  <p>Thanks a lot!   </p>
  
  <pre><code>/******* This in index.js *********/
  // setup passport for username &amp; passport authentication
  adminToolsSetup.setup(passport);
  
  // admin tool login/logout logic
  app.post("/adminTool/login",
      passport.authenticate('local', {
          successRedirect: '/adminTool/index.html',
          failureRedirect: '/',
          failureFlash: false })
  );
  app.get('/adminTool/logout', adminToolsSetup.authenticateUser, function(req, res){
      console.log("logging out");
      console.log(res.user);
      req.logout();
      res.redirect('/');
  });
  
  
  // ******* This is in adminToolSetup ********
  // Setting up user authentication to be using user name and passport as authentication method,
  // this function will fetch the user information from the user name, and compare the password     for authentication
  exports.setup = function(passport) {
      setupLocalStrategy(passport);
      setupSerialization(passport);
  }
  
  function setupLocalStrategy(passport) {
      passport.use(new LocalStrategy(
          function(username, password, done) {
              console.log('validating user login');
              dao.retrieveAdminbyName(username, function(err, user) {
                  if (err) { return done(err); }
                  if (!user) {
                      return done(null, false, { message: 'Incorrect username.' });
                  }
                  // has password then compare password
                  var hashedPassword = crypto.createHash('md5').update(password).digest("hex");
                  if (user.adminPassword != hashedPassword) {
                      console.log('incorrect password');
                      return done(null, false, { message: 'Incorrect password.' });
                  }
                  console.log('user validated');
                  return done(null, user);
              });
          }
      ));
  }
  
  function setupSerialization(passport) {
      // serialization
      passport.serializeUser(function(user, done) {
          console.log("serialize user");
          done(null, user.adminId);
      });
  
      // de-serialization
      passport.deserializeUser(function(id, done) {
          dao.retrieveUserById(id, function(err, user) {
              console.log("de-serialize user");
              done(err, user);
          });
      });
  }
  
  // authenticating the user as needed
  exports.authenticateUser = function(req, res, next) {
      console.log(req.user);
      if (!req.user) {
          return res.send("401 unauthorized", 401);
      }
      next();
  }
  </code></pre>