#16: finishing half-assed backend login