Use /user API in authentication