add request specs for login and logout