create user model
add user authentication
also protect api