properly configured login/logout urls and coming-from urls