refactored logout to sessions controller to allow logout of denied users