add basic login/logout function
protect new/create/edit/update/destroy for everything except login