basic security setup
users are currently stored in flatfile security.yml
next commit will be putting them in mysql via ORM