fixed protected resource request to obtain user information