added client side authentication (gave up on node/passport based
on assumption that nodejs server is behind firewall anyway).  Still
need to give user ability to change password