don't clear message when loading login view; add ability to test auth timeout