All auth using fannie. Give users 'timesheet_access' authorization.