1)complete login/out function with session. 2)add role property to user