What if the `login()` fails? Then there is no session to logout ...