authenticate passwords, store appropriate cookies
logout handler