fix userRepo' to actually use auth token