super basic auth done, but it sux