feat($auth): login/logout behavior #2