basic user auth works, more to come