add logout API, add put() after generating token to actually save the change