add user object into result of '/auth' API