We could add a `logout` function that sets `user`, `access_token` and `refresh_token` to None.