auth behavior handled - changing state and logout action