oauth-server: return user on /auth OK