[wip user] return full user object on find
[wip] passport auth