app.'s annotation + add a  '/signout' route to delete the 'live' cookie