Change auth

Don't merge yet; this is just an experimental idea of how to do authentication. 
Can we add a TODO in there to delete the file if we're not going to to use it? (or just delete it?) It'll still be in version control.