login and logout seem to be working. used session and session.pop instead of login_user ext