proper logout via session