fix `user.toClient()` and pass active status