added role constants, changed session destroy method to index() on logout controller