start refactoring to use secure social, not functional, WIP