implements login, logout, and whoami APIs.