moved plugin files into subdirectory

added authentication (but no reate user)