http form security: login/logout
doc