Change dao.user to dao.auth to avoid misunderstanding