huge refactoring + first working authentication