I would add a comment here about how we use session cookies, so there's no explicit "logout" button for users, and their session is implicitly "logged in" until they close their browser.