user authentication -- still needs to generate key
user authentication -- still needs to generate key