* fixed user retrieval response with bad credentials