refactor log_in spec
user can now actually logout
add authentication before action
user api returns user info