still figuring out user authentication