updated user authentication and authorization