rather than not return user profile, which seems to prevents later auth checks, simply callback with accessToken as displayName (for the time being); it would be better to all something within ping, such as the validation endpoint that may be configured to return user attributes. more to come...