fixed security/login issues once and for all.  added script to home.xhtml that logs user out (logout button didn't execute logout() method before).