Add `/logout` and clarify the endpoints which do not take a JSON request body.