user authentication complete, fully tested