add login and logout support
add permission check
rm models/db.js