wip - authentication - session/user/cookies
use _initialize_request to determine auth needed
show login form before showform if auth required
implement authentication handlers