in reply to logout button

Writing over the cookie with some non-allowable value is better, since some browsers are not good about resolving cookie expiration dates.

See HTTP::Cookie.