adds Shiro plugin, first pass of user authentication and access control