yes you need to pass in token, because that's the only way for the API to know which user wants to logout