challenge-response should DELETE the session resource by default

[thomas-fossati]

By default we should call DELETE on the session resource.

We could also add a with_keep_session() method to the builder to override the default.