user auth call to verify access token and return user object