* fix: 2 possibilities of sending wrong movie position
* test user/pass outside git, separate non-versioned file
* store the refresh token, transition to token-auth