pass oauth token when loading user

`UserResponseInterface` misses some important info like `refresh_token`, `expires_in` that can be valuable during authentication. Bring up `OAuthToken` to fill the gap