really finish user authentication