Fix: login/logout routes