Session invalidation is done after the custom error handling