1. should be idempotent, ie multiple logouts should just do nothing
2. after logout, session should be deleted: `session.reset()` Then, it's possible to check if there is a valid session by doing `if(session) { /* bla */ }`
3. don't throw exceptions