Should these events be `login` and `logout` instead of `onlogin` and `onlogout`?