simple auth implementation on top of gorilla mux / session