add home grown authentication - part 1