add username instead of userId to authentication response