fix user auth stuff to use Api::User