added logout controller to invalidate session