login/out without sessionToken