add login and logout, allow access without login