partial implementation of web auth