much cleaner version of auth service that doesn't use , make logout work by manually clearing user object