moved login and logout to their own controller