Why do a user need both sessionToken and sessionId for logout? - ZITADEL