remove user/token headers after logout. fixes #158