user authentication require login to do actions