the logout request must be get and not delete