moved settings to app.GLOBALS
authenticate actually checks username/password
view correctly parses url params