bug fixed: logout session not removed