implement login/logout completely, close #3