basic authn + authz strategy works
template renders raw javascript object to pass to parent window