LoginModel.logout() clears $_SESSION