login handler now logs user in and out. (no authentication though)