move page generation to handler, work on auth.