basic auth - will never be secure because no https
start adding login