Update AuthorizeUser to return a user object on success