More work on user auth, /login and /logout