User auth

for the record, I'm proud as fuck of this. first time implementing simultaneous auth on front and back ends, worked perfectly on the first try, and it's cleaaaaan.