properly signing users in and out