moved toward claims authentication, implemented registration, login, basic auth, mess in code