user can create account, user can login with username-pass, user can logout