login logout with proper session cookie