moved auth to user model