set DB close on exit to false
added logout button to header
hide users list if empty
only apply OAuth for protected paths
added bunch of tests