user object removed from request, auth fixed