log out if no token (assume must have one), still issue with hsts and response.reDirect