try authenticate_user: mv helper to controller