logout API deletes session cookie now