full user authentication