added basic login page
not actually a secure login yet
instead of storing a auth token, it store a boolean "logged_in"