login/logout/sessions... via server-side basic auth proxy