add first plugin endpoint, TODO: figure out why PLUGIN_AUTH support is super screwy :(