first draft for user authorization