Changed logout route to use session.destroy()