basic user authentication and sessions. closes #3