+1 bug in logout()