add user logins/logouts to REST API
make document request handlers more RESTful