leaving this is a totally f'ed state for now...

w/r/t the state machine for login/password collect, etc.