finish ch 6, user model. auth