add some header checking and fake usename pw stuff. just need logic to sign it.