fix users, add auth page
authorization