fixed logout so it actually sets session to undefined