return user when authenticate