initial working version of openid connect auth

`not authenticated` instead of `no authenticated`?