in _parse_user_response user is a string, needs to be a dict

I'm trying to use this in a project, and I wasn't able to run get_authenticated_user because in _parse_user_response, user is a str when you call user.update, but it needs to be a dict.

Also, for whatever reason, user has really weird json encoding, with tons of \\ to escape ". Because of this, double decoding user is required. I changed the way tornado.escape.decode_json is imported in order to make the double decode look a little cleaner.

This package is really helpful to me. I really didn't want to have to implement this myself. Thanks!