In order to prevent leaking of session values (and to avoid the mess of
deleting the entire session cookie which could still have values we want
in it) this nuclear method is now called by expire/logout with a
whitelist of keys to keep (passed in from
Config.Storage.SessionWhitelistKeys).
- Make this change to make it a bit more chi/alice friendly
since this is typically the form of middlewares to be constructed
and then turn into a "middleware" function/type.
- This may seems silly but the functionality is shared
between oauth2 and auth with no changes so it makes it nicer
not to have an oauth2/logout route like before
