login, logout, hash, acl are verified