auth before user_credential