But I can export REMOVE-SESSION if people think that'd be useful.

I'm not sure about others, but I think it would be helpful when multiple session variables are being set in different parts of the web app, when you could invalidate the entire session when a user logs out, instead of deleting each session variable - it's possible that the developer forgot to delete this particular session var in the logout method (this just happened to me :D).

> And setting *session* to nil doesn't seem to do this.

Of course not. This variable is only bound to the session object
while the handler is active.