login/logout API spec