Allow logout only on an authenticated session

[nustiueudinastea]

Currently, the logout route doesn't check if the user is authenticated. This is not a big issue because the session cookie is only known by an authentication user, but it should be fixed.