login, createuser and getuser all return a user object