login logout using session tokens