basic endpoint checking, authorization checking, and user login/logout seems to be working