fix auth token handling in logout process