finished login/logout flow with basic per-user-type permissions