Auth.session now passes user data object to callback