It's strange that the <span> in the login object is never used. Also that the handleAuth function uses the existence of 'logoutUrl' to decide wether it should refresh or redirect, but uses it for nothing else.