first commit, working web app with login authentication checks