fix auth in user path api