[fix] local/oauth provider user validation