major rewrite of the backend -- metadata now encrypted via AES with the password