logoff.php had TOKKEN instead of TOKEN