login inside the auth strategy has to do the majority of work now, and logout would be ran in any login failures
No more session expire exception, tests are going to break [ci skip]
some comments [ci skip]