logout with session.flush()