user should be able to login logout