logout ignores security