update user working, auth not