add a very basic authorisation scheme, see #35