add initial OCRA support (only one way so far, no password/session)