auth user beforehand