using an actually trusted and secure auth provider

rolling my own auth