further authorisation:
  - added local storage support for authorised user so that refresh does not log user out
  - added auth check on server to validate that the user is logged in on the server