should remove authenticate_user!