sign_out should use DELETE, not GET