fixed bug in user authentication