add user authentication, but not yet test