basic authentication logic laid out