removed unnecessary cookie secret
added auth to endpoints; user token now reset upon logout