reset auth token every sign-in
add sign out via http