fix api auth & preloading of the user