add rules for login/logout