user auth & requests+