added basic auth for user actions