switches to getting logout token from request body