user can destroy his session - log out