backported internal user auth