authenticates based only on user