header and invalid session after logout