* display login failure/logout success within the header itself
* fix a previous-masked bug in which api_core.logout() was failing