deauthorize user on logout