check for bearer auth when getting user