title: identity 2.2 logging off doesn't destroy session
body: <p>After a pen test of our system, it was pointed out that when a user is logged out, that users session is still active, although the cookie is deleted. I have confirmed this by copying the .AspNet.ApplicationCookie value, and made a request to an otherwise restricted site with Postman. When debugging i can see that even after i abandon the session, the session persists with an ID.</p>
  
  <p>This is my current LogOff method:</p>
  
  <pre><code>        public ActionResult LogOff()
      {
          HttpContext.Response.Cache.SetAllowResponseInBrowserHistory(false);
          HttpContext.Response.Cache.SetCacheability(HttpCacheability.NoCache);
          AuthenticationManager.SignOut(DefaultAuthenticationTypes.ApplicationCookie);
          HttpContext.Session.Clear();
          HttpContext.Session.Abandon();
          HttpContext.Response.Cookies.Add(new HttpCookie("ASP.NET_SessionId", ""));
          return RedirectToAction("Index", "Home");
      }
  </code></pre>
  
  <p>I wonder if this is a bug in Identity or MVC or is it me that's missing something?</p>
  
  <p>I am using Identity 2.2.1 with Entity Framework 6 and MVC 5</p>