added extra assertion to make sure user is returned on PUT