use h4 for user name
add auth filter