auth works fine now: securing admin page. main controller addded, covering header, footer.