remove owner from URL; derive username from logon; hardcode 2 usernames and passwords; add logout link in header