Send XHR login/logout requests with credentials.

Only try to clear auth if no login failure.