redoing user api, now auth