user authentication fixed