add user auth (incompleted)