cookie_auth hooked up
warden session detached
explicit session revocation
remote deauth seems actually to work
and out again