clear auth token on logout
support real authentication