use error UX instead of alert()
implement logout via XHR (POST "null" assertion, fixes #15)