logout works, logged out users get redirected