backend complete! can add user auth later if you want