add xcas+xml junk under auth
extract dartmouth fields from cas response
basic webauth
destroy session on logout
show user in view
merged with auth