implement signout action.
/signout routes to session.destroy.
add signout link to header, and it will be shown only if user signed in.
add icon to sign in button.