user authentication done, still messy