only perform auth check when user is loaded

user being authenticated is not enough, all the attributes need to be loaded and merged into the user object in order to have them available for arbitrary checks in authCheck