cors: logout