[api] removes 'api-token' on logout