A full user object is also passed from the server on authentication