Fixes to user auth
More tweaks to user permissions & auth