move logout route to auth