server: add a logout route

This route should invalidate the token