add auth flow: login/logout