concept working version, not secure for production though