use auth token to find user for api session logout action