Check if there is a logged user before logout.

Only execute the `SessionsController#destroy` if there is a logged in
user, otherwise it will raise `ActionController::InvalidAuthenticityToken`.

Fixes #2934.

cc @josevalim @lucasmazza