client can auth and pull users
merged master