well, simple but extensionable auth added