local auth. adding 'shibetoshi' user in app.js for convenience for now