updated userapi.js/logout() to return status code 200 no matter what. since the session no longer exists if the verifyToken() comes back bad, there's no reason to return a client error response.