I'm not sure about this line. Shouldn't we call `auth.logout`?