Basic user handling & authentication

[chrisbutler]

current idea: authenticate with a 'secret string'

simplest: include a query param in the url, like ?secret=<string>

better: enter secret once, create a session cookie: https://github.com/expressjs/cookie-session

best (hardest): wire up a node/express user management package: https://www.npmjs.com/package/passport

[dreeves]

What about http://auth0.com? (But definitely expediency-ueber-alles at this point -- whatever's the quickest way to get something usable for just ourselves. Everything else we can worry about later!)

[dreeves]

Another idea: what about just oauthing with Beeminder?

But then should it be ok for your commits.to username to not match your Beeminder username (I want dreev.commits.to, and probably also danny.commits.to, but I'm beeminder.com/d)? Maybe for super-special me I'll put in a custom redirect but other people need to just use their Beeminder username?