login and logout endpoints is provided use the user model and password-hash method