added authentication, user query