logout is a GET request