local password login, logout and session endpoints