logout requires auth