authenticate and authorization for user model