- login works across the whole stack
- username & password authentication works
- users can be created programmatically with a username and password