post requests can have query string parameters
logout resolves with undefined when there's no client-side session; lower-level users.create