users can logout from a persistent session and can be forgotten