tweak user auth method