use django.contrib.auth - very basic atm