getting user during authentication has to be transactional to avoid
hibernate update object conflicts for user description