client can auth and pull users