What if the server doesn't care? Should this require being enabled? Should this be a `DELETE` request to a `session` endpoint instead of a `POST` to `logout`?