you must provide a log out url