logout works on the server. on get /logout, req.session is set to null. then on reload, user will get a new session