returns user object after authentication