logout done, but todos left on cookie secret setting and safely clearing session variables