persistence of login over client-side page refresh; also "handle" multiple endpoints