login/logout with token system in place