closes #2 - add auth