leave logout as _REQUEST for now