Added logout, plus switched isRegistration flag to be a session
attribute to avoid it affecting the ID hash
Early sketches towards a Shiro realm implementation