users can sign in and sign out, authentication