in src/main/java/org/apache/sling/auth/xing/oauth/impl/XingOauthAuthenticationHandler.java [241:250]
protected void removeAuthFromSession(final HttpServletRequest request) {
try {
final HttpSession httpSession = request.getSession();
httpSession.removeAttribute(OAuthConstants.TOKEN);
httpSession.removeAttribute(OAuthConstants.ACCESS_TOKEN);
httpSession.removeAttribute(USER_SESSION_ATTRIBUTE_NAME);
} catch (Exception e) {
logger.error(e.getMessage(), e);
}
}