i've noticed that the login and logout function can be invoked anytime.

example, if user is already logged in, and happens to login again by opening another page, the login function still works.

same with logout, if user logs out from one page of your site, and also logs out from the other page of your site, the function call still execute it.

just a suggestion, i think it would be better if a user is already logged in and tries to logged back in, the login function will do a check, and if so, will not execute the call. same with the logout function too.