remove user/token headers after logout. fixes #158
merge fix for #158