fix(auth.socialLogin): always return user info and sess_id, even after initial create/login