Implemented log out action that clears client data and removes user from server session

There is still a bug in this: whoAmI() isn't permitted to return null for the SessionScoped user bean.
This will require a little refactoring to make the CDI usage legal.