Fix logout

One must not delete session before returning response.