login now returns whole user instead of role