sign out users with http DELETE