Implement /logout.

POST /logout destroys session.