In my logout function, I have
HttpContext.Current.Session.Abandon();
HttpContext.Current.Response.Cookies["ASP.NET_SessionId"].Expires = DateTime.Now.AddYears(-30);
I see that the response contains set-cookie for ASP.NET_SessionId with the proper expiration, but then the browser (Chrome in this case) never actually deletes the cookie.