return entire user json on GET /user/signin
user update via PATCH/PUT /user instead of /user/update
add field for storing the client IV for a secret