moving userauth to a better place