user authentication without gem