refactor and fix user auth