user  can log in and out