authentication for admin page - single level still.
default user as guest if not set.