fixed user authentication in user model