apply expansions to user deserialization

Apply the same expansion to `deserializeUser()` as in the `authenticate()` call.
Merge pull request #11 from doublerebel/patch-1

apply expansions to user deserialization [Fixes #10]