cause there is a refresh cookie which is tied to

/api/auth/session/refresh

which also needs to get cleared. And that can only be accessible if you navigate to that on your browser (if using chrome)