adding server side auth to users resource