add logout to sessions controller with tests