Fix logout() by testing for active session before destroying