add user auth + tests