implement login and logout policy