Check if there is a logged user before logout.

Only execute the `SessionsController#destroy` if there is a logged in
user, otherwise it will raise
`ActionController::InvalidAuthenticityToken`.

Fixes #2934.