better errors for failed login/signup
allow config for *only* in-memory storage