added basic password protection
changed express to 3.x
changed user list to JSON