Logout link and user profile not functioning

1 - I can't seem to replicate the behavior you are describing when logging out. I thought it happened once where it was still behaving like I was logged in, but I can't get it to happen again. I did, however notice a mistake in your doLogin.php:

<?php
  'sub' => "{$user['id']}",

You were missing the ($) in front of user, so the actual user_id wasn't being saved in the cookie. Though I doubt that particular issue was a problem with the logout, it would be with other functions.

2 - For the FlashBag messages, you need to add these two lines to any page that might display them:

        <?php echo display_errors(); ?>
        <?php echo display_success(); ?>

Basically, any page that you redirect to after a potential success/error should have those lines. The template works best when you put them under an <h2> element for the given page. You should probably include them in all the "views" (index, account, add, edit, login, register).

3 - Here's the entirety of my doLogin.php to see example usages for for FlashBag messages

<?php

require __DIR__ . '/../inc/bootstrap.php';

$user = findUserByEmail(request()->get('email'));
if (empty($user)) {
    $session->getFlashBag()->add('error', 'Username was not found');
    redirect('/login.php');
}

if (!password_verify(request()->get('password'), $user['password'])) {
    $session->getFlashBag()->add('error', 'Incorrect password');
    redirect('/login.php');
}

$expTime = time() + 3600;

$jwt = \Firebase\JWT\JWT::encode([
    'iss' => request()->getBaseUrl(),
    'sub' => "{$user['id']}",
    'exp' => $expTime,
    'iat' => time(),
    'nbf' => time(),
    'is_admin' => $user['role_id'] == 1
    ], getenv("SECRET_KEY"),'HS256');

try {

$accessToken = new Symfony\Component\HttpFoundation\Cookie('access_token', $jwt, $expTime, '/', getenv('COOKIE_DOMAIN'));
} catch (\Exception $e) {
    throw $e;
}
$session->getFlashBag()->add('success', 'Logged In.');
redirect('/', ['cookies' => [$accessToken]]);

Make sure the paths for writing cookies are the same in all the places. If you're just using '/' it should be easy, but that little bug caused me a little "research".

If that's the case, like it was in mine -- I used /books as the folder for development of this mini-project off the root. So, when I was writing cookies, in one place I was writing to /books -- then, when trying to over-write the cookies, I was writing to /books/ -- those aren't the same.

I couldn't decide if I should be proud of myself for sticking with it until I figured it out -- or mad at myself for making that mistake in the first place. I guess being persistent and getting the desired result is the main thing.