add authorization, no friendly forwarding yet
Finish user updates