auth.user now available on scope