Use $GLOBALS['session']->destroy() instead of setting $_SESSION['current'] = "". Using "" means that $_SESSION['current']

could be set but be a string. Don't call addmsg() after logging out otherwise the session message will be lost and can
show up for other users or be stuck in the database

include/user.php

@@ -82,15 +82,16 @@ class User {
             return SUCCESS;
         }
 
-        /* null out the session variable for the current user since we failed to login */
-        $_SESSION['current'] = "";
+        /* destroy all session variables since we failed to login */
+        $GLOBALS['session']->destroy();
+
         return USER_LOGIN_FAILED;
     }
 
     function logout()
     {
-        /* null out the session current variable to log us out */
-        $_SESSION['current'] = "";
+        /* destroy all session variables since we are logging out */
+        $GLOBALS['session']->destroy();
     }