fixed user authentication