cleaned up some authentication code

post to /auth/logout succeeding is now the only way to actually logout
also auth.username and auth.gravatr reset upon logout as well
cbugg: close bug-265