Authorization page

first pass with basic initialization tests. Currently just supports allow and disallow. The logout link is rendered but not wired up.