app skeleton, with basic authentication