use user.auth instead