now with less-ugly css
some session management, user auth