logout should unset session