fixed signup, user roles were not being set properly

We also changed the response to match a successful `/login`.