The user should probably be signed in during the setup phase, otherwise you can't prove that logout process actually removes the session since it never existed in the first place.