fifth commit - security and authentication are actually working