auth/whoami now returns a root_box