working more than a skeleton, no real auth yet