attach the user to the token after login callback