- more work on user authentication