Bottle user auth