auth machinery for user