Return auth token on user endpoint

closes #288