End a session (idempotent; does NOT delete its artifact)

Authenticate every request with Authorization: Bearer <token> — a JWT or API token.