auth/whoami returns user_metadata

Also: refactor part of IndxOpenId to IndxUser