user auth major rewrite