redirects and user authentication