added user token
reworked auth