auth against the db itself

simple auth_user db param to enable. users in auth_file are used first, if they exist.