registration all good (save info); /api/user/logout unlocked