avoid modification of request.protocol while sign out, otherwise logout_url would be wrong