Fix next handler: clear session before nextHandler called

[moldauder]

when user if null after getUser(), module user can control the flow back to the next process, so session must clear