make the basic auth-y dance piece work; still need to set up users