login mechanism impl: token is fake
logout impl