Use logout API to clear session server-side

Because the client should totally do this!