rig up logout against the api server

extract session management responsibilities into SessionManager class.
trigger success and failure events for every session lifecycle event
(start, resume, end). move logout functionality to happen on session
end success event. set Authorization header for destroy request. merge
Credentials into Session.