added login/logout message, fixed auth/session