moving user api calls to own class so we can secure it easier