user can log in and log out