Login: return user object instead of redirect