default menu is not yet useful, but the handler mostly works. except for actual auth/perm checks since we have no users yet!
also docs + tests for what we have so far