initial working version of openid connect auth