start of user auth