`autoCommit = false` makes `ctx.session = null` not work for clearing cookies

Cookies are cleared by `ContextSession#commit()` if `ContextSession#session` is `false`.

For `ContextSession#session` to become `false` using the public api, you must use the setter `ctx.session = null`.

But, then when you want to run `ctx.session.manuallyCommit()`, the `ctx.session` getter returns `null`.

It works when `autoCommit = true`, because it runs `ContextSession#commit()` after all middleware has run, which will remove the session.

Security vulnerability is [session fixation](https://www.owasp.org/index.php/Session_fixation) from session key re-use. Hackers steals cookie, user logs out, then logs back in, hacker still has access.

---

**Workaround**

```
const sessionContext = ctx.session._sessCtx
ctx.session = null
await sessionContext.commit()
```

---

@dead-horse Any chance getting a fix for this?

@galvez Maybe you can think of a way to do it, as you implemented `autoCommit`.

Start by tracing ContextSession#commit(), the session getter and setter, and the autoCommit path described in the issue. Compare the public ctx.session = null flow with the _sessCtx.commit() workaround. Done means a session can be cleared without reusing its key while ctx.session.manuallyCommit() remains usable when autoCommit is false.

Written by the indexing model from the issue text.