refactored to marionette, pending basic auth