The login/logout feature should get its own spec.