can authenticate based on checking hashes in query-params
401 response to unauthenticated
added username password and tokens to the schema