Get auth working with Post folders with JSON payload

still everything is hardcoded. yeah, it is a good step.