valid user requirement must come after auth definition