little more work on authentication and ORM