create an auth that will lock the extension behind a sign in. focus on google first and then add the rest, using express and password js