not working. first approx of user and permission models
auth logic moved to directory structure to allow nested realms in the future