1. add login/logout process
2. improve admin or user role check