logout URL doesn't need callback
 - login URL needs proper param name and endcoded URL