deserialize undefined user

A user was valid when the session was established and has been deleted now. When we find this user in the database, it could be return as `undefined`.