destroy token when logout