logout doesn't unset session id