add /logout post route
logging in should create a new session