fixed user auth