User auth finally working. Next: protect admin area