added login with any pass if no users present
added required auth if request is not HTML
added sensitive data access tests