passing sessions.Store to NewHandler
/logout and added logic to deny missbehaving cookie jars