in src/main/java/org/apache/sling/auth/form/impl/FormAuthenticationHandler.java [905:910]
public void clear(HttpServletRequest request, HttpServletResponse response) {
HttpSession session = request.getSession(false);
if (session != null) {
session.removeAttribute(sessionAttributeName);
}
}