fixed logout and session management