fixed up user authentication flow