user authorization

it’s almost ready for multiuser support. at least more ready than before