added logout directive to destroy user creds