accept transit from client
send transit back instead of json; implement Flask-Login correctly; implement logout