clean-up: user can't be null if checkAuth passed
basic subscriptions