login and logout routes work