fake login/logout flow