[picnic] user authentication