finally got basic auth working. needs refactor & clean-up