logout with token deletion on server side