ch 6 basic user model w some auth