My session is now BOTH a cookie and in the DB after a3m implementation

[eluser]CroNiX[/eluser]
The session details get stored in the database. The cookie (should) only have the session ID stored in it if you use database sessions, although it would be encrypted. This is needed so your app can get the correct data from the session table between page loads (get session ID from cookie, retrieve database where session id is equal to session id in the cookie).

Using session:ess_destroy() when logging out should remove the cookie as well as the session data from the database for that users session instance.