only allow logout if logged in