refactored user auth behavior