more basic auth, needs a logout