move login/logout handlers back into auth object