updates to Auth.java. this will now return the user object and cache it for up to 5  minutes