preparing to use openid, but am going to look at flask-openid first
without flask-login