user can login and logout