user-authentication almost works