set user in security context after external auth, too