Fix a bug if someone goes to logout without been logged in

Also simplified the cookie value. Don't think obscuring
the session id will do any difference here.