adding test for getting actual user if client credentials was used to login