user auth, js updated