moved user creation and authentication to a service