protected void removeFromSession(Subject subject) {
        Session session = subject.getSession(false);
        if (session != null) {
            session.removeAttribute(DefaultSubjectContext.AUTHENTICATED_SESSION_KEY);
            session.removeAttribute(DefaultSubjectContext.PRINCIPALS_SESSION_KEY);
        }
    }
Removes any existing subject state from the Subject's session (if the session exists).  If the session
does not exist, this method does not do anything.

@param subject the subject for which any existing subject state will be removed from its session.
core/src/main/java/org/apache/shiro/mgt/DefaultSubjectDAO.java