WIP - auth (closes #1)