auth: always return ErrInvalidToken, even when token don't exist

It doesn't matter either the token exists or not.
api: added logout handler

Related to #401.
api: register logout handler

Related to #401.
cmd: added logout command

Closes #401.