inject auth + user