working on user auth
shakey, but valid user auth