check hashed password against hashed env variable, assign token based on that. logout by destroying token key in session map.