Logs the current user out of their account.

• Requires that the session hash is sent as well, to prevent automatic logouts by images or javascript.
• Doesn't check the session if internal is true.
• Redirects back to $_SESSION['logout_url'], if it exists.
• Accessed via ?action=logout;sesc=...