now ghetto auth to CAS to protect page
authenticated users now part of could setting