switch to passport/request, add basic login