fix(auth): fix json in POST /auth response