Drop the session row and clear the cookie.
Successful Response
Bare-success body for login / logout / change-password.
Login + logout side-effects (session cookie set/cleared) are carried on the HTTP response itself; the body just acknowledges the outcome.