allow user lookup by auth token