change auth to djang.contrib.auth; add login/logout