move authentication code into separate file
updates app
add account page for now
add user whitelist through env var