authorize() and restore() now return user data