fix auth, add logout