add logout, fixed client recieving passwordHash after login