move auth levels to User class