add some garbage authkey to the app config
play around with auth tokens, this is totally not real
add a core app which will end up being the interface to external services