rewrote user auth to be lightweight