logout is a POST action