tweak login/logout. todo: check for sessionStorage, ifnot -X cookies, handle username+pass-Xhash auth-Xid-Xjson.