main: switch /signin to /session and allow users to logout by sending a DELETE to /session