don't redirect to http if session is started
destroy session after logout

- allows getting redirected to http