change around user model
update notes
add auth controller