auth.py prototype part 2 (validate, logout)