inject authentication, fix hcl for auth
update form posting to use correct target, inject auth