unset($username) will umm, unset $username =)
I note that there are some oddnesses with session variables, e.g. if you call session_destroy(), the variables registered for the session will still be set for the duration of that request. At least, that is my experience. You have to explicitly call unset().
HTH,
AC