authentication built (not tested); working on authorization