loaded users couldn't actually do anything due to sloppy auth
new clojar