login/logout fix. authorization is checked via the loginContext's
subject