fixed accessToken sticking around after logout