working auth. TODO: logout post