change login_handler to auth_handler
add logout