login/logout handling server side done