add userId to authentication response