move controller auth logic to a concern
logout link