breaking auth out of userAPI and add callback params to user find ops