enhanced user object and added password auth