separate user-logic from auth.